Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 18 Oct 2016 14:06:41 +0200
From: Adam Maris <amaris@...hat.com>
To: oss-security@...ts.openwall.com
Cc: kaplanlior@...il.com
Subject: Re: CVE assignment for PHP 5.6.27 and 7.0.12

On 18/10/16 09:42, Lior Kaplan wrote:
> Hi,
>
> Please assign a CVE for the following issue:
>
> Bug #73147    Use After Free in unserialize()
> https://bugs.php.net/bug.php?id=73147
> http://git.php.net/?p=php-src.git;a=commit;h=0e6fe3a4c96be2d3e88389a5776f878021b4c59f
>
> Thanks,
>
> Kaplan
>
16 bugs marked as 'security' were fixed in php 5.6.27 of which only one has CVE assigned.
Here you request CVE for another one issue (even the documentation says it's unsafe to use
unserialize on untrusted input).

Are you planning to obtain CVEs also for other security bugs or do you treat the rest as
CVE-unworthy? Or are reporters/community supposed to do it?

Thanks!

-- 
Adam Mariš, Red Hat Product Security
1CCD 3446 0529 81E3 86AF  2D4C 4869 76E7 BEF0 6BC2


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ